The work only one person can do.

It is four things, not one

Key-person risk is usually discussed as though it were about seniority. It is not. It is the concentration of four separate things on one individual, and someone junior can easily carry more of it than a director.

• Responsibilities they own with no working backup
• Knowledge areas where they are the only person who understands it
• Systems only they can reach
• Relationships — customers or suppliers who deal only with them

Rank by cost, not by count

Someone holding eleven responsibilities sounds worse than someone holding three. It often is not. A weekly obligation with a statutory deadline and no backup outranks nine quarterly ones that could slip a fortnight without anybody noticing. Rank by what two weeks of absence would actually cost.

Say it about the business, not the person

This matters more than it sounds. "Laura is a single point of failure" is a sentence about Laura. "The ACME implementation process has one expert and no documentation" is a sentence about the business, and it is the one that produces a fix rather than a defensive conversation. Keep to the second form, including in your own head.

Three legitimate responses, and one that is not

For each concentration you can train a second person, document the process well enough that somebody competent could follow it, or accept the risk deliberately with a named decision-maker and a review date. All three are fine. Leaving it undiscovered is the only option that is not, and it is the default.

Documentation is the cheapest of the three

Training a second person costs weeks. Writing down how the thing actually works costs an afternoon and gets you most of the benefit. Ask the expert to do it while somebody who does not know the process watches — the gaps become obvious immediately, which they never do when the expert writes it alone.

The test is a fortnight, not a resignation

Planning for somebody leaving is planning for an event with notice. The sharper test is two weeks of unplanned absence starting tomorrow. Almost every company passes the first test and fails the second, and the second is the one that actually happens.

Check it when the shape changes

A quarterly review of this gets skipped. Attach it instead to the moments that already happen: someone joins, someone leaves, someone changes role, or you take on a new recurring obligation. Each of those changes the concentration, and each is a natural moment to look.